Security
Every statement on this page describes the actual running code, not an aspiration. 'Trust us' is never the answer we ask you to accept.
This is the architecture, not a policy promise. Verification agents run on your machines against your repositories with your credentials. The only bytes that reach Vestal are a pass/fail ping, an optional duration, and an optional short message you control. There is no code path by which file contents, encryption keys, or repository credentials could reach our infrastructure.
Keys are 256 bits of random entropy, shown to you exactly once, and stored only as SHA-256 hashes. A database compromise does not hand an attacker your live credential, and we could not email you your key even if you asked, which is the point.
Passwords are hashed with per-user random salts using PBKDF2-SHA256. The iteration count is bounded by our edge platform's per-request CPU budget and is lower than OWASP's ideal. We say so plainly rather than hiding it: the salt still defeats precomputed-table attacks, and the self-describing hash format lets us raise the cost factor later without invalidating existing accounts. Password verification is constant-time.
Session cookies are 256-bit random tokens with a 30-day expiry, HttpOnly. Password-reset tokens live for one hour, are single-use, and a successful reset revokes every existing session for the account: if the old password was compromised, so were its sessions.
Signup, login, forgot-password, and the ping endpoints are all rate-limited (for example: 10 login attempts per 15 minutes per IP, 30 pings per minute per token). Brute-forcing credentials or flooding a ping URL hits a wall, not a database.
Alert targets must be https and are checked against loopback, private, link-local, and cloud-metadata address ranges before Vestal will ever call them. Your alert channel can't be turned into a proxy for probing internal networks.
The scheduler that watches your checks is wrapped in its own failure detection: if it crashes, it alerts us through an independent path and then surfaces the error to the platform's retry machinery. A public /health endpoint verifies live database connectivity, so you can point your own uptime monitoring at Vestal too.
No analytics scripts, no ad pixels, no fingerprinting, no third-party JavaScript at all. One session cookie, only after you log in. The site you're reading loads fonts and everything else from our own domain.
Found something? We want to know, and we'll be grateful rather than defensive. Email security@vestalapp.com with enough detail to reproduce the issue. You'll get an acknowledgment, a fix timeline, and public credit in the changelog if you'd like it. Please test only against accounts you control. Ask us first if you need a sandboxed account to probe harder than normal use allows.
Every claim on this page describes what's actually running in production today.